fix(server): strip replayable terminal queries from history

[StiensWout]

Summary

• Strip replayable DECRQM/DECRPM, XTVERSION, kitty-keyboard, DECRQSS, and XTGETTCAP traffic from persisted terminal history in both 7-bit and 8-bit forms.
• Preserve legitimate setters and visual control sequences, including DECSTR, DECSCL, DECSCUSR, restore-cursor, styles, and clears.
• Keep live terminal output unchanged and add focused Manager regression coverage for reopen history, chunk splits, setters, and existing OSC behavior.

Why

Reopening a terminal replays its persisted output. Capability queries in that history can trigger fresh replies, which the shell then displays as visible gibberish at the prompt.

Validation

• pnpm exec vitest run --config apps/server/vite.config.ts apps/server/src/terminal/Manager.test.ts --testNamePattern='(strips replay|handles CSI|preserves clear|ESC sequences)'
• vp run --filter t3 typecheck
• vp fmt --check apps/server/src/terminal/Manager.ts apps/server/src/terminal/Manager.test.ts

Implemented and validated by Codex (GPT-5.6) in T3 Code.

Playwright verification

The recording shows query traffic around visible terminal output, a thread reload/reopen, and the same clean output after history reattachment.

---

Note

Low Risk
Scoped to terminal history persistence and sanitization logic with regression tests; no auth, data, or live output path changes.

Overview
Extends persisted terminal history sanitization so reopening a session no longer replays capability queries that make the terminal answer again and leave junk at the prompt.

CSI stripping now drops DECRQM/DECRPM ($p/$y), XTVERSION (>q), and kitty keyboard (?u) traffic, with guards so setters like DECSTR, DECSCL, DECSCUSR, and restore-cursor still stay in history.

DCS stripping is new via shouldStripDcsSequence for DECRQSS and XTGETTCAP query/reply pairs ($q/$r and +q/+r), in both 7-bit (ESC P) and 8-bit (0x90) forms. Live PTY output is unchanged; only what gets written to history is filtered.

Tests add reopen scenarios for mixed CSI/DCS traffic, chunk-split sequences, and setter preservation alongside existing OSC behavior.

^{Reviewed by Cursor Bugbot for commit bdb85ee. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Strip replayable CSI and DCS query sequences from terminal history

• Extends shouldStripCsiSequence in Manager.ts to also strip DECRQM/DECRPM ($p/$y), XTVERSION (>q), and kitty keyboard (?u) query/reply sequences, while preserving setter sequences like DECSTR (!p) and restore-cursor (u).
• Adds a new shouldStripDcsSequence helper that detects and strips DCS-based query/reply traffic (DECRQSS, XTGETTCAP, and their [01]$r/[01]+r replies).
• Updates sanitizeTerminalHistoryChunk to apply DCS stripping alongside the existing OSC and CSI filtering, covering both 7-bit and 8-bit encodings and sequences split across output chunks.
• Adds tests covering split sequences and mixed visible/query output to verify history is clean on terminal reopen.

^{Macroscope summarized bdb85ee.}

closes #4776

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 07937800-5cda-4dd7-9492-ae38d8182537

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Approved bdb85ee

This is a straightforward bug fix that extends existing terminal history sanitization to strip additional query/reply escape sequences (DECRQM, XTVERSION, Kitty keyboard, DCS) that cause junk output when replayed. The changes follow established patterns, are well-documented, and include comprehensive tests.

^{You can customize Macroscope's approvability policy. Learn more.}